Researcher uncovers Android SMS phishing vulnerability

  • Jon Gold (Network World)
  • — 02 November, 2012 20:32

A researcher at North Carolina State University has uncovered a vulnerability that could be exploited to send deceptive text messages from some Android devices, as part of a phishing scheme.

MORE ON ANDROID: Hottest Android news and rumors for the week ending Nov. 2

Particularly worrisome is the fact that the vulnerability doesn't need any elevated app permissions in order to function, said NCSU computer science professor Xuxian Jiang.

"The vulnerability allows a running [untrusted] app on the phone to fake an incoming SMS text message with arbitrary content, including the text message itself as well as the 'sending' phone number, which can be your friend in the contact list or simply your trusted banks," Jiang said in an email to Network World.

The flaw is apparently present in the Android Open-Source Project, and some versions of the software ranging from 1.6 (Donut) to 4.1 (Jelly Bean) are vulnerable. Jiang said that his team has been able to exploit it on the Samsung's Galaxy Nexus, Nexus S and Galaxy S III, HTC's One X and Inspire, and the Xiaomi MI-One.

Jiang praised Google for reacting quickly, confirming the presence of the vulnerability within two days of receiving the team's report. In the email, he expressed hope that a rapid patch would be forthcoming.

Jiang did not provide full technical details of the flaw, citing responsible disclosure issues, although he did describe the vulnerability as difficult to detect but easy to exploit, once found.

Jiang has been at the forefront of the discovery of several other Android security flaws, including, in June, a rootkit attack that might have allowed malicious software to be concealed on an affected device. He is the founder of the Android Malware Genome Project, an academic investigation of security threats affecting the platform.

Email Jon Gold at jgold@nww.com and follow him on Twitter at @NWWJonGold.

Read more about software in Network World's Software section.

Tags: gingerbread, Networking, Android, wireless, anti-malware, North Carolina State University, Xiaomi, htc, Google, smishing, consumer electronics, security, Android smishing, smartphones, mobile security, software, phishing, Ice Cream Sandwich, android malware

DDoS botnets already smarter, fiercer in 2014: Imperva Incapsula

READ THIS ARTICLE
MORE IN Data Security
DO NOT SHOW THIS BOX AGAIN [ x ]
Comments are now closed.
CSO Corporate Partners
  • Webroot
  • Trend Micro
  • NetIQ
rhs_login_lockGet exclusive access to CSO, invitation only events, reports & analysis.
CSO Directory

Endpoint Encryption

Robust data protection for PCs, smartphones, and removable media

Latest Jobs
Security Awareness Tip

Incident handling is a vast topic, but here are a few tips for you to consider in your incident response. I hope you never have to use them, but the odds are at some point you will and I hope being ready saves you pain (or your job!).


  1. Have an incident response plan.

  2. Pre-define your incident response team 

  3. Define your approach: watch and learn or contain and recover.

  4. Pre-distribute call cards.

  5. Forensic and incident response data capture.

  6. Get your users on-side.

  7. Know how to report crimes and engage law enforcement. 

  8. Practice makes perfect.

For the full breakdown on this article

Security ABC Guides

Warning: Tips for secure mobile holiday shopping

I’m dating myself, but I remember when holiday shopping involved pouring through ads in the Sunday paper, placing actual phone calls from tethered land lines to research product stock and availability, and actually driving places to pick things up. Now, holiday shoppers can do all of that from a smartphone or tablet in a few seconds, but there are some security pitfalls to be aware of.